THE AVERAGE EXPONENT OF ELLIPTIC CURVES MODULO p 
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Abstract. Let E be an elliptic curve denned over Q. For a prime p of good 
£Sj ■ reduction for E, denote by e p the exponent of the reduction of E modulo p. 

Under GRH, we prove that there is a constant Ce € (0, 1) such that 

-L ep = 1 - Ce x + O e (x^ (log x)^) 

for all a; ^ 2, where the implied constant depends on E at most. When E has 
complex multiplication, the same asymptotic formula with a weaker error term 
Oe{1/ '(logs) 1 / 14 ) is established unconditionally. These improve some recent re- 
sults of Freiberg and Kurlberg. 



^ ! 1. Introduction 

+-> 

Let be an elliptic curve defined over Q. For a prime p of good reduction for 
E the reduction of E modulo p is an elliptic curve E p defined over the finite field 
¥ p with p elements. Denote by E p (¥ p ) the group of F p -rational points of E v . Its 
structure as a group, for example, the existence of large cyclic subgroups, especially 
of prime order, is of interest because of applications to elliptic curve cryptography 
[5, 8]. It is well known that the finite abelian group E p (¥ p ) has structure 

m '. 

■ (1.1) E p (¥ p ) ~ (Z/dpZ) © (Z/epZ) 

^ . for uniquely determined positive integers <i p and e p with d p \ e p . Here e p is the size 

of the maximal cyclic subgroup of E p (¥ p ), called the exponent of E p (¥ p ). The study 
about e p as a function of p has received considerable attention [11, 3, 1, 2], where 
the following problems were considered: 

^ ■ • lower bounds for the maximal values of e 



(N 



• the frequency of e p taking its maximal value, i.e., the density of the primes 
p for which E p (¥ p ) is a cyclic group, 

• the smallest prime p for which the group E p (¥ p ) is cyclic (elliptic curve 
analogue of Linnik's problem). 

Very recently motivated by a question of Silverman, Freiberg and Kurlberg [4] in- 
vestigated the average order of e p . Before stating their results, let us fixe some 
notation. Given a positive integer k, let E[k] denote the group of fc-torsion points 
of E (called the k-division group of E) and let Lk := Q(E[k}) be the field obtained 
by adjoining to Q the coordinates of the points of E[k] (called the k-division field 
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ofE). Write 

(1.2) n Lk := [L k : Q]. 

Denote by /i(n) the Mobius function, by ir(x) the prime- counting function and 
by C-L fc ( s ) the Dedekind zeta function associated with L k , respectively. Assuming 
the Generalized Riemann Hypothesis (GRH) for CL fc ( s ) for all positive integers k, 
Freiberg and Kurlberg [4, Theorem 1.1] shew that 

(1-3) ^-r J2 ^ = \Cex + E {x^{\ogx)^) 

^ ' p^x 

for all x ^ 2, where 

(1.4) ^-E— E— = 11^-1:— Y 

The implied constant depends on E at most. When E has complex multiplication 
(CM), they [4, Theorem 1.2] also proved that (1.3) holds unconditionally with a 
weaker error term 



(1.5) E [x 



lOggX 



\og 2 x] ' 

where log^ denotes the Mold iterated logarithm. 

The aim of this short note is to propose more precise result than (1.3) and (1.5). 

Theorem 1.1. Let E be an elliptic curve over Q. 

(a) Assuming GRH for the Dedekind zeta function (L k for all positive integers k, 
we have 



(1.6) ^e p = l -C E x + E (x^(\ogx)^). 

(b) If E has CM, then we have unconditionally 

(L7) ^g e -^ + -((i^)w)- 

Here C E is given as in (1.4) and the implied constants depend on E at most. 

Remark, (a) Our proof of Theorem 1.1 is a refinement of Freiberg and Kurlberg's 
method [4] with some simplification. 

(b) For comparison of (1.3) and (1.6), we have yjj = 0.9 and | = 0.833 

(c) The quality of (1.7) can be compared with the following result of Kurlberg and 
Pomerance [6, Theorem 1.2] concernng the multiplicative order of a number modulo 
p : Given a rational number g ^ 0, ±1 and prime p not dividing the numerator 
of g, let igip) denote the multiplicative order of g modulo p. Assuming GRH for 
C(Q( 9 i/fe iC 2 7 ri/fc)(s) for all positive integers k, one has 



X 



where C g is a positive constant depending on g. 



g x y/2-l/\og 3 : 
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2. Preliminary 

Let E be an elliptic curve over Q with conductor N E and let k ^ 1 be an integer. 
For x ^ 1, define 

7r £ (a;;A;):= 1. 

The evaluation of this function will play a key role in the proof of Theorem 1.1. 
Using the Hasse inequality (see (3.1) below), it is not difficult to check that p \ d p 
for p \ N E . Thus the conditions p \ N E and k \ d p are equivalent to p \ kN E and 
k | dp, that is p \ kN E and E p (¥ p ) contains a subgroup isomorphic to Z/kZ x Z/kZ. 
Hence by [9, Lemma 1], we have 

l = n E (x;k) + 0(log(N E x)). 

p^x 

p splits completely in L k 

In order to evaluate the sum on the left-hand side, we need effective versions of 
the Chebotarev density theorem. They were first derived by Lagarias and Odlyzko 
[7], refined by Serre [12], and subsequently improved by M. Murty, V. Murty and 
Saradha [10]. With the help of these results, one can deduce the following lemma 
(cf. [4, Lemma 3.3]). 

Lemma 2.1. Let E be an elliptic curve over Q with conductor N E . 

(a) Assuming GRIT for the Dedekind zeta function Ci fe ( s ); we have 

(2.1) 7r E (x;k) = ±^ + 0(x 1 ' 2 log(N E x)) 

uniformly for x ^ 2 and k ^ 1, where the implied constant is absolute. 

(b) There exist two absolute constants B > and C > such that 

(2.2) n E (x; k) = ^ + 0(xe' B ^' /14 ) 

unformly for x ^ 2 and CN E k lA ^ logx, where the implied constant is absolute. 

The next lemma (cf. [4, Proposition 3.2] or [2, Propositions 3.5 and 3.6]) gathers 
some properties of the division fields of E and estimates for ni k , which will be 
useful later. Denote by <f(k) the Euler function. 

Lemma 2.2. (a) The field contains Q(e 27rl//fe ). Therefore (p(k) \ nL k and a 
rational prime p which splits completely in Lj, satisfies p = l(mod/c). 

(b) n Lk divides |GL 2 (Z/fcZ)| = k 3 ip(k) U p ^(l - p~ 2 ) . 

(c) If E is a non-CM curve, then there exists a constant B E ^ 1 (depending 
only on E) such that \GL 2 (Z/kZ)\ ^ B E n Lh for each k ^ 1. Moreover, we have 
\GL 2 (Z/kZ)\ = ni k whenover (k,M E ) = 1 (where M E is Serre's constant). 

(d) If E has CM, then ip(k) 2 < n Lk ^ k 2 . 
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3. Proof of Theorem 1.1 
Let a E {p) := p + 1 — \E p (F p )\, then 

'(p + l-a E (p))/dp Hp\N E , 
otherwise. 



6p 



By using Hasse's inequality 

(3.1) \a E (p)\<2^ 

for all primes p \ N E) it is easy to see that 

r 3/2 



< 32 » I> = E fe;- 

P^z p^.pfiVs p \ b / 

In order to evaluate the last sum, we first notice that the Hasse inequality (3.1) 
implies d, p ^ 2y/p. Thus we can use the formula 



i = V 



k m 

dm\k 

to write 

(3-3) = E"E ^= E Ef 

p^z P p^z c(m|dp k^2^xdm=k p^x 

p\N E p\N E ' p\N E ,k\d p 

Let y ^ 2y/x be a parameter to be choosen later and define 

*:=££— E P. 

dm=k p^x 

p\N E ,k\d p 

*== E Ef E f 

y<k^2^x~dm=k p^x 

p\N E ,k\d p 

With the help of Lemma 2.1(a), a simple partial integration allows us to deduce 
(under GRH) 



px px 

p= t dir E (t; k) — xir E (x; k) — I ir E (t;k)dt 
P ^x h- h 

^ NE ' kK r U(r) 1 r 

(3.4) = xli[x)__^ U(t)dt + E (x^ 2 \ogx) 

^L k n Lk J 2 

= ]M^) +0 r x 3/2 ^ N 

On the other hand, by Lemma 2.2 we infer that 

(3.5) j2—J2 m - c -+°(y- 1 y 

k^y dm=k 
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Thus combining (3.4) with (3.5) and using the following trivial inequality 



(3.6) 
we find 

(3.7) 



E 

dm=k 



m 



< m <1 

k 



s 1 = u( X >)j2—Y.—+ 4 x3/2l °z x Il E— ) 

k^y K dm=k k^y dm=k 



fcsgj/ 

= C E U(x 2 ) + E 



x 



+ x 3 ^ 2 y log x 



y log x 

Next we treat S2. By [4, Lemma 3.1 and Proposition 3.2(a)], we see that k \ d p 
implies that k 2 \ {p + 1 — a E {p)) and also k \ (p — 1), hence k | (ae(p) — 2). With 
the aid of this and the Brun-Titchmarsh inequality, we can deduce that 



*<* E ( E E 

y<k^2^/x \a\^2y/x,a^2p^x,aE{p)=a 
a=2(modfc) k 2 \p+l—a 

«i J2 ( 



E 



1 



p^x,a E (p)=2 
k 2 \p~l 



X 



y<k^2yfx 

By virtue of the elementary estimate 



^Jx X 
~T ' k<p(k) \og(8x/k 2 ) + k 



V- 



D\ogt + 0{l) (t^l) 



with some positive constant D, a simple integration by parts leads to 



(3.8) 



S 2 < 



x 



5/2 



X 



y 2 \og{8x/y 2 ) y 
Inserting (3.7) and (3.8) into (3.3), we find 



(3.9) 



^ = C E U{x 2 ) + E (x^ 2 y\ogx + 



x 



5/2 



+ 



X 



p^x,p\N E 



y 2 \og(8x/y 2 ) yj' 



where we have used the fact that the term x 2 y~ l (\ogx)~ 1 can be absorded by 
x^/ 2 y~ 2 (\og{8x/y 2 ))~ l since y ^ 1\fx. Now the asymptotic formula (1.6) follows 
from (3.2) and (3.9) with the choice of y = x l ^{\ogx)~ 2 ^ . 

The proof of (1.7) is very similar to that of (1.6). Next we shall only point out 
some important differences. 

Similar to (3.4), we can apply Lemma 2.1(b) to prove (unconditionally) 

p = + E (x 2 exp{-B(hgx) 5 / u }) 



p^x 
p\N E ,k\dp 



for k < {C^Nz 2 log x) 1 / 14 . As before from this and (3.5)-(3.6), we can deduce that 
(3.10) S 1 = C E Li(x 2 ) + E {x 2 y- 1 (logx)- 1 + x 2 ye- B ^ 5/14 ) 
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for y < (C^N' 2 logx) 1 / 14 . 

The treatment of S2 is different. First we divide the sum over k in S2 into two 
parts accroding to y < k ^ x^Qogx) 3 / 4 or x^Qogx) 3 / 4 < k ^ 2y / x. 

When E has CM, we have (see [3, page 692]) 

1 < -n^n — 

^ ^(A;) 2 logx 

pfJVs,fe|dp 

for ^ x 1//4 (logx) 3 / 4 . Thus the contribution from y < k ^ x 1 / 4 (log re) 3 / 4 to S2 is 



x 2 ^ 1 a; 2 



yKk^x 1 ' ^ (log x)- 3 '* 

Clearly the inequality (3.8) (taking y = a; 1 / 4 (log a;) 3 / 4 ) implies that the contribution 
from x 1/4 (logx) 3/4 < k ^ 2^/x to S 2 is 

^ (logx) 5 / 2 
By combining these two estimates, we obtain 

2 2 
X X 



(3.11) 5 2 «- + 

ylogx (logx)°/ z 

Inserting (3.10) and (3.11) into (3.3), we find 

1 ] v ^nJv Kv^gx (iogx) 5 / 2 ; 

for y < (C-^/logx) 1 / 14 . 

Now the asymptotic formula (1.7) follows from (3.2) and (3.12) with the choice 
of y= (C- 1 AT- 2 logx) 1 / 14 . 
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